New York Markets After Hours

'Phishers'hit Salesforce.com

JohnLetzing

SAN FRANCISCO (MarketWatch) -- Online scammers have used data lifted from Salesforce.com Inc. to help them try to dupe computer users with fraudulent emails, according to a pair of reports.

Data managed by Salesforce.com
CRM, -0.14%
a rapidly growing company that provides businesses software via the Internet to manage their contacts and customers, was used in a September "phishing" scam unleashed on customers of Automatic Data Processing Inc.
ADP, -0.51%
according to a note released to clients Monday by JMP Securities analyst Patrick Walravens.

In addition, the online edition of the Washington Post reported Friday that Salesforce.com data was used in a similar scam perpetrated in September on customers of SunTrust Banks Inc.
STI, +1.15%

Phishing scams involve the sending of emails designed to look as if they're coming from companies or financial institutions, in order to get recipients to submit sensitive data such as bank account information.

Salesforce.com vice president of corporate strategy Bruce Francis declined to discuss "the security of individual customers."

In an emailed statement, Francis said that, "Phishing is increasingly a fact of life on the Internet. Like a number of major Internet services in banking, retail, and other areas, we've seen an increase in phishing activity over the past few months."

Salesforce.com does not typically store sensitive information such as credit card and social security numbers, Francis said. He also said the company provides tools for customers to help defend against phishing attacks.

Walravens wrote in his note that ADP and Salesforce.com did not directly confirm that Salesforce.com's system was breached as part of the phishing scam. ADP did say that 900,000 of its "customer and prospect records had been illegally accessed in the attack," Walravens wrote. Emails sent to those contacts had attachments that could deliver "malicious code" to recipients' computers if opened, Walravens wrote.

ADP currently has some 7,600 subscribers to Salesforce.com's popular software service, Walravens wrote.

ADP spokeswoman Elena Charles did not immediately respond to a request for comment. SunTrust spokesman Hugh Suhr also did not immediately respond to a request for comment.

ADP disclosed the phishing scam Sept. 14, saying its own systems were not attacked. It did not identify Salesforce.com's involvement at that time. See related story

Intraday Data provided by SIX Financial Information and subject to terms of use.
Historical and current end-of-day data provided by SIX Financial Information.
All quotes are in local exchange time. Real-time last sale data for U.S. stock quotes reflect trades reported through Nasdaq only.
Intraday data delayed at least 15 minutes or per exchange requirements.